- Removed the "Who's Watching" sub-profile picker entirely: ProfileProvider now
auto-resolves the single profile tied to the account immediately after login
- Backend: removed POST/DELETE /profiles (no more creating/deleting extra
profiles — lifecycle is entirely driven by user create/delete, already wired
in the admin Users CRUD); kept GET (internal) and PATCH (edit your own
profile's avatar/kids-mode/rating cap)
- Deleted ProfileSelect page and the now-unused ProtectedRoute component
- Navbar: removed the "switch profile" action, account avatar is now just a
static display
- api.js: dropped the now-dead X-Profile-Id header logic (backend already
falls back to the account's single profile when the header is absent)
- New /admin/users page: create/delete users, toggle admin role, guarded against
self-demotion/self-deletion
- Backend: GET/POST/PATCH/DELETE /api/admin/users, admin-only
- Settings moved from /admin/settings to /settings (all logged-in users); the
password-change section shows for everyone, integration/API-key sections only
render (and only fetch) for admins, since those endpoints stay admin-gated
- Navbar: Settings link now visible to all users; added Users nav link for admins
Myron Blair